formbook

General

Target

ur0Wh1IXZqT3XDP.zip
Size

427KB
Sample

220723-f8hxzacfaj
MD5

cdf6218ca670e8ca9f988570518601e2
SHA1

74cb700f31e657f2bc3ae6143b3bf23b7538921f
SHA256

7c2cab5c4ff191f935293bf1625e73da3fd2b025b335fe075a186e8c9672dc45
SHA512

01074dbf4b738b0b5ede81b297583a7f37d671d9dfbc8fa51c8019c80554b4f17f54216b7c8cd4d75af4e096c839d950947dfc5ed6a6770e223d5b6f79078357

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.9

Campaign

zzun

Decoy

JnNtRHyNupy0GqRzAcasu7hb4rc=

Qv593NGLE7p9UNSaVkPXljAJm2QCNnc=

ePArIFWvjkkMgVEVhw4M4Jk=

26rqUwJ7dD0AiDI=

pBAxMHeK741QFw==

kHD7TPt5846pUMTX

56UnjFjHL1i0j659h3LymRnHpQj+SshC

4vKlKHflPqmWXRbrRwfPtrhb4rc=

6LBd4qButFAi

phMzGll8Ue7Fu+inq5cdnPaSugG3

NKswiQGCvZoG5FgsdHEI

rtTHnuUY8M1qVcXV

SOmECrlAt2oGAA==

L1ep9adutFAi

/UE+/AyvE6uEl28weFI=

IP+xMPQxJR4NE6TK

xvW5GN9/rqA5YUoOVt185Sf7Uw==

fRFNW9DhxL6VF7LA

KFYTfkaY741QFw==

W4JGvMBmt2oGAA==

Targets

- Target
  
  ur0Wh1IXZqT3XDP.exe
- Size
  
  495KB
- MD5
  
  389205cb7d0e4aff8ced73933cb8c540
- SHA1
  
  7feda5387f15dd58f5479184c698811fd829604e
- SHA256
  
  b4a7371bb84b4f72e390e8f247a7978f2c2ff173d555261442151ef918cdb969
- SHA512
  
  0ef5eb7aec2c239ba58ede1149874f2e4795ef33edad824e289d37c9b7bf639262306ac569be8b832c69a90eaabb3bda812efc009fb2a9b11eb41cc21cfb7703
Score

10^/10

formbook xloader zzun loader persistence rat spyware stealer suricata trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata
- Xloader payload
  rat
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader

suricata: ET MALWARE FormBook CnC Checkin (GET)

Xloader payload

Adds policy Run key to start application

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2